permdock 0.4.0 → 0.6.0

package/dist/{validity-dVrUEPJt.js → validity-CZ7-y0Cj.js}

@@ -1,5 +1,6 @@
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { c as ownKeys, o as isForbiddenKey, s as ownGet } from "./thenable-QSmvt-vZ.js";
+import { i as ownKeys, n as isForbiddenKey, r as ownGet } from "./paths-DXSHAMIa.js";
+import { c as instantOf, g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
 //#region src/core/fields.ts
 function sanitizeFields(fields) {
 	if (fields === void 0) return;
@@ -25,17 +26,6 @@ function sanitizeContext(value) {
 //#endregion
 //#region src/core/validity.ts
 /**
-* An instant as Unix seconds: a finite number is taken as seconds already, a
-* string must parse as RFC 3339. Anything else is `undefined`, and the caller
-* decides whether that is "absent" or an error.
-*/
-function instantOf(input) {
-	if (typeof input === "number") return Number.isFinite(input) ? Math.floor(input) : void 0;
-	if (typeof input !== "string" || input.trim() === "") return;
-	const millis = Date.parse(input);
-	return Number.isFinite(millis) ? Math.floor(millis / 1e3) : void 0;
-}
-/**
 * The normalised validity of a grant, or `undefined` when neither bound is
 * set. Fail-closed at definition time: a bound that does not parse, or a
 * window that ends before it starts, throws so a typo never widens a grant.
@@ -43,8 +33,8 @@ function instantOf(input) {
 function normalizeValidity(options, permissionKey) {
 	const from = options.validFrom === void 0 ? void 0 : instantOf(options.validFrom);
 	const until = options.validUntil === void 0 ? void 0 : instantOf(options.validUntil);
-	if (options.validFrom !== void 0 && from === void 0) throw new Error(`PermDock: validFrom on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
-	if (options.validUntil !== void 0 && until === void 0) throw new Error(`PermDock: validUntil on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
+	if (options.validFrom !== void 0 && from === void 0) throw new Error(`PermDock: validFrom on '${permissionKey}' must be an RFC 3339 string or an Instant`);
+	if (options.validUntil !== void 0 && until === void 0) throw new Error(`PermDock: validUntil on '${permissionKey}' must be an RFC 3339 string or an Instant`);
 	if (from !== void 0 && until !== void 0 && until <= from) throw new Error(`PermDock: validUntil on '${permissionKey}' must be after validFrom`);
 	if (from === void 0 && until === void 0) return;
 	return Object.freeze({
@@ -58,5 +48,32 @@ function isActive(validity, now) {
 	if (validity.from !== void 0 && now < validity.from) return false;
 	return validity.until === void 0 || now < validity.until;
 }
+function wireValidity(validity) {
+	if (validity === void 0) return;
+	return Object.freeze({
+		...validity.from === void 0 ? {} : { from: rfc3339(validity.from) },
+		...validity.until === void 0 ? {} : { until: rfc3339(validity.until) }
+	});
+}
+/**
+* The validity of a wire grant. A malformed window fails closed for the
+* grant's effect: an allow never applies (`{ from: +∞ }`), a deny always
+* does (no window), so a corrupt bound can never lift a deny.
+*/
+function readWireValidity(value, effect = "allow") {
+	if (value === void 0) return;
+	const malformed = effect === "deny" ? void 0 : NEVER;
+	if (typeof value !== "object" || value === null) return malformed;
+	const from = "from" in value ? value.from : void 0;
+	const until = "until" in value ? value.until : void 0;
+	const start = from === void 0 ? void 0 : secondsOf(from);
+	const end = until === void 0 ? void 0 : secondsOf(until);
+	if (from !== void 0 && start === void 0 || until !== void 0 && end === void 0) return malformed;
+	return Object.freeze({
+		...start === void 0 ? {} : { from: start },
+		...end === void 0 ? {} : { until: end }
+	});
+}
+const NEVER = Object.freeze({ from: Number.POSITIVE_INFINITY });
 //#endregion
-export { sanitizeContext as a, pickVisible as i, normalizeValidity as n, sanitizeFields as o, grantCoversField as r, isActive as t };
+export { grantCoversField as a, sanitizeFields as c, wireValidity as i, normalizeValidity as n, pickVisible as o, readWireValidity as r, sanitizeContext as s, isActive as t };

package/dist/{verifier-DMr_Zmb_.js → verifier-DHuh-okk.js}

@@ -1,6 +1,7 @@
 import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { o as isForbiddenKey, u as splitPath } from "./thenable-QSmvt-vZ.js";
-import { t as loadJose } from "./load-jose-BL6LH4bL.js";
+import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
+import { p as nowSeconds } from "./time-DkWjdL98.js";
+import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 //#region src/jwt/header.ts
 function compactParts(token) {
 	return token.split(".");
@@ -90,10 +91,11 @@ function assertSafeClaimPaths(claims) {
 		claims.roles,
 		claims.groups,
 		claims.entitlements,
+		claims.plans,
 		claims.tenant,
 		claims.memberships,
 		claims.session
-	].filter((path) => path !== void 0);
+	].filter((path) => typeof path === "string");
 	if (typeof claims.assurance === "string") paths.push(claims.assurance);
 	else if (claims.assurance !== void 0) paths.push(...[
 		claims.assurance.acr,
@@ -128,11 +130,12 @@ function assertVerifierConfig(options) {
 }
 function assertSubjectConfig(options) {
 	if (options.verifier === void 0) {
-		assertVerifierConfig(options);
+		assertVerifierConfig(verifierOptions(options));
 		if (options.jwks !== void 0 && !isSecretJwks(options.jwks) && options.issuer === void 0) throw new Error("PermDock: issuer is required with jwks.");
 	}
 	assertSafeClaimPaths(options.claims);
 	if (options.profile === "fapi2" && options.sender === "none") throw new Error("PermDock: profile 'fapi2' requires a sender constraint.");
+	if (options.verifier === void 0 && options.audience === void 0) throw new Error("PermDock: audience is required; pass audience: false to accept a token minted for any audience.");
 }
 function secretBits(secret) {
 	if (typeof secret === "string") return secret.length * 8;
@@ -142,6 +145,14 @@ function secretBytes(secret) {
 	if (typeof secret === "string") return new TextEncoder().encode(secret);
 	return secret;
 }
+/** The verifier options of a subject config: `audience: false` means none is checked. */
+function verifierOptions(options) {
+	const { audience, ...rest } = options;
+	return audience === false || audience === void 0 ? rest : {
+		...rest,
+		audience
+	};
+}
 //#endregion
 //#region src/jwt/cache.ts
 function clampTtl(seconds, minTtl, maxTtl) {
@@ -297,7 +308,7 @@ function createKeyCache(options) {
 		}
 	};
 	const resolve = async (force, nowInput) => {
-		const now = nowInput ?? Math.floor(Date.now() / 1e3);
+		const now = nowInput ?? nowSeconds();
 		if (options.jwks instanceof URL) return loadJwks(options.jwks.href, now, force);
 		if (typeof options.jwks === "string") return loadJwks(options.jwks, now, force);
 		if (options.jwks !== void 0 && typeof options.jwks === "object" && "keys" in options.jwks) return {
@@ -317,7 +328,7 @@ function createKeyCache(options) {
 			return resolve(false, now);
 		},
 		refetchJwks(now) {
-			const current = now ?? Math.floor(Date.now() / 1e3);
+			const current = now ?? nowSeconds();
 			if (current < cooldownUntil) return resolve(false, current);
 			cooldownUntil = current + cooldown;
 			return resolve(true, current);
@@ -499,4 +510,4 @@ function joseTokenVerifier(options) {
 	}
 }
 //#endregion
-export { decodeHeader as a, issuerFromDiscovery as i, assertSubjectConfig as n, normalizeTyp as o, fail as r, joseTokenVerifier as t };
+export { verifierOptions as a, issuerFromDiscovery as i, assertSubjectConfig as n, decodeHeader as o, fail as r, normalizeTyp as s, joseTokenVerifier as t };